{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:53c494cf-4833-51b5-a92b-e78805ab9c2c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@2.0.8",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@2.0.8",
      "version": "2.0.8",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-26870",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:ac75a693-ce4a-58d2-a5aa-4519b648a8e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-26870 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.4."
      }
    },
    {
      "id": "CVE-2024-45801",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:3ead3c43-8a4e-5f6d-adb8-cf098f34ced9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-45801 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-47875",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:ce8cc970-2248-5346-b4c8-a660258e97c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-47875 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-48910",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:597ca908-6249-5616-b159-5dfcd86614a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-48910 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.5."
      }
    },
    {
      "id": "CVE-2025-26791",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:119d0f72-83a8-5156-a12f-cd928efe4386",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-26791 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.4."
      }
    },
    {
      "id": "CVE-2026-41239",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:12d49c5e-47d7-58cd-8ca7-5064c6735977",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41239 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41240",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:89c5e959-214b-5f12-a93a-dfbcc8f29d85",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41240 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-49458",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:393ef5ce-b3b2-5459-acd5-414a60efdd93",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49458 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-49459",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:9d989662-999f-5f99-8889-2eae4600fb09",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49459 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-49978",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:4abaf05d-c3b0-5d28-a05f-cedcdf3e7bc5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49978 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65898",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:6342cb15-0a51-50d9-a7aa-7305da9974d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65898 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65899",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:17b5bd0c-d1b4-5682-898a-b85a680a86b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65899 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65901",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:2d8a7f9f-4386-5f98-a4e5-67a3d2901f24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65901 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:58dbbdb7-7018-5741-bdb8-ce06ac7529bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65902 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65903",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:e0fddb41-0f8a-5cd1-9d75-7d6991baa2cd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65903 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65912",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:32c5bccb-43fd-5a9e-a34a-2740338ad1e5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65912 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65913",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:30ec0ea9-6961-52ae-b1f8-f336d69e5414",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65913 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65914",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:13453c53-c472-5213-93f4-1efdcd52f30a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65914 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:f3d8d41f-16f8-5c51-afbe-22ac2088f7e5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-66010 does not affect version 2.0.8 of dompurify. not_affected \u2014 DOMPurify version 2.0.8 is NOT affected by CVE-2026-66010 (GHSA-c2j3-45gr-mqc4). The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which does not exist in this version. Version 2.0.8 predates the TypeScript rewrite (uses JavaScript src/purify.js, not src/purify.ts) and the introduction of CUSTOM_ELEMENT_HANDLING. All surviving elements in version 2.0.8 go through the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-75838",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:edd1495f-fdbc-5513-be6e-30e00aff241a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-75838 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.3."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:541b4e42-cef1-5064-aeeb-316eb0c1107a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.0.8 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:498b9e8a-42e6-5a68-85f8-65d5cb8e6925",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.1."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:e0cff5ce-63b9-52aa-8852-93a4750f433f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 2.0.8 of dompurify, and is fixed in 2.0.8-tuxcare.6."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:e959dee0-2d02-5cf5-b9c8-e5a99a6662b8",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.0.8."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@2.0.8"
        }
      ],
      "bom-ref": "urn:uuid:43f2650f-c7eb-54a0-9879-4ba07aa4b38e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 2.0.8 of dompurify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@2.0.8"
    }
  ]
}